One aspect is nicely described by @AJHenderson and involves a potentially insecure password reset verification scheme, if end user's computer was compromised by a key logger.
Another is pointed out by @Zaffy and is concerning using one of the published values for verification. I would add to it that these changes are usually prompted by changes in EULA/TOS of websites, and if so, you could find your answer there. Did they change their terms of service lately? Or perhaps the service provider wanted their members to be able to publish their email addresses to other members, if they chose so? Either case, if email address will suddenly become visible to other members, then that's a clear case for hardening log-in security by using non-disclosed user data.
But there is possibly also another security related reason not to include user email addresses. If the log-in process in any way discloses which of the two required fields didn't match any record in the registered users database (by a distinct error message, by removing invalidly input field values,...). That is, if a log-in process was too user friendly with its responses, an attacker could quite easily gain knowledge, whether a certain email address is registered with the website in question. Which might in turn invalidate EULA/TOS addressing any such privacy concerns. While having such 'user friendliness' in place is greatly diminishing security on its own, many web developers still didn't discover this website, to know any better.
Another, albeit less strictly security related reason why developers decided to change the log-in process, could also be they're planning to expand their business to third-parties and the EULA/TOS you were agreeing with when signing-up didn't cover disclosing your email address to these third-parties. This way, they could avoid invalidating their very own EULA/TOS and still offer third party services to an already existing user base, identifying network users by non-private data.
You are right though to doubt there's any security benefits, as advertised on this SWTOR page. It does seem rather strange how they can claim greater protection against possible account takeovers, when an attacker would now be only a password away from successfully logging-in as another user, whereas before both username and password were adding to the entropy of the whole process. Curious indeed. Then again, I'm not a SWTOR player, which is curious enough on its own :)